me thinks you will have to get down and dirty on this one. you are going to have to look at exactly what the phone is sending - i am not sure if you can get everything simply by turning up the verbosity on the console but it is worth a try. if not then turn on the packet capture in the yealink phone and use tcpdump to capture the traffic from the phone and to/from the pbx. i like wireshark to view the captured files.
what you do know is if the transfer is properly completed (## plus extension) it does work. what you also know is that using a button (set as blf or transfer) does not work.
you should be able to see what happens on a successful transfer (no ghost call) and to see what is different when using the blf key.